VULNERABILITY INTELLIGENCE

CVE-2023-47798

CVSS score5.4 MEDIUM
EPSS probability0.31%
CISA KEVNot currently listed
Published2024-02-08
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Description

Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked.

Weakness classification

  • security@liferay.com: CWE-384
  • nvd@nist.gov: CWE-384

Primary references